I've been thinking for a while execshield.patch could be split into two or three cleaner patches. Some of those might even be upstreamable as config options or something. It really isn't that big a patch at this point.